OCap Discipline

A "main" that should execute in a scope with lots of authority is indicated by #!/usr/bin/env node at the top (and +x file permissions). A test script is named test-*.js. No modules should export powerful objects (for example, objects that close over fs). Note that tests don't export anything. (#2160)

Background

A key to cooperation without vulnerability is object capability discipline, which consists of:

• Memory safety and encapsulation: There is no way to get a reference to an object except by creating one or being given one at creation or via a message; no casting integers to pointers, for example.
  From outside an object, there is no way to access the internal state of the object without the object’s consent (where consent is expressed by responding to messages).

• Primitive effects only via references The only way an object can affect the world outside itself is via references to other objects. All primitives for interacting with the external world are embodied by primitive objects and anything globally accessible is immutable data. There is no open(filename) function in the global namespace, nor can such a function be imported -- converting a string to file access is much like converting an integer to a pointer.

Object Capabilities are often abbreviated as OCaps; hence OCap discipline.

On the Agoric platform, OCap discipline is enforced on contracts.

While JavaScript platforms (browsers, node) don't enforce OCap discipline in general, SES lets us layer it on top.

References

• 2006-05: Miller, M.S.: Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control. PhD thesis, Johns Hopkins University, Baltimore, Maryland, USA
  • See also a history of E’s ideas.